Page Comparison

Content-Type *required

String (header)

This is always application/json

Authorization

String (header)

Include this header if you want to use a token to authorize your request. When you use a token, only the Content-Type and Authorization parameters are required.

See Authorizing Query API requests for more information.

x-logtrust-apikey

String (header)

This is the Devo domain API key found in Administration → Credentials.

x-logtrust-sign

String (header)

HMAC SHA-256 using the API_SECRET to sign the concatenation of the api_key, body message and timestamp

x-logtrust-timestamp

String (header)

Timestamp in milliseconds.

query

String (body)

This is the query that you want to run, expressed in LINQ. To find the query's LINQ script, open the query in the Data Search area, then choose Query code editor from the toolbar.

The body of the request must contain either the query or the queryId parameter.

queryId

String (body)

This is the ID of the query that you want to run. To find the query ID, open the query in the Data Search area, then choose Additional Tools → Current query → Get ID.

The body of the request must contain either the query or the queryId parameter.

from *required

Number (body)

The start date as a UTC timestamp in seconds. See the Relative dates section below to learn more about this parameter.

to

Number (body)

The end date as a UTC timestamp in seconds. If this parameter is left out, the query will be continuous. See the Relative dates section below to learn more about this parameter.

mode

Object (body)

This object contains the mode.type parameter to specify the format of the response. If left out of the request body, the default response type JSON will be used.

mode.type

String (body)

The format in which you want the response to be sent. The possible values are:

• json
• json/compact
• json/simple
• json/simple/compact
• msgpack
• csv
• tsv
• xls

These response formats are fully described later in this article. When you indicate a response format other than json, you must include the dateFormat and timeZone parameters.

destination

Object (body)

This object specifies where the response should be sent. If this object is left out of the request body, the response will be sent back to the request source.

destination.type

String (body)

This is the type of system to which the response should be sent. The possible values are:

• hdfs

• s3
• email
• snmp
• kafka

Depending on the destination.type, additional parameters will be required. See the related HDFS, S3, email, SNMP and Kafka articles.

destination.params

List (body)

Destination parameters, depend on the destination.type. Check the HDFS, Kafka, S3, email and SNMP articles to see the parameters required for each destination.

dateFormat

String (body)

This is only required when you specify a mode.type other than json. The possible formats are:

• default - yyyy-MM-dd' 'HH:mm:ss.SSS
• sql - yyyy-MM-dd' 'HH:mm:ss.SSS
• iso - yyyy-MM-dd'T'HH:mm:ss.SSSXX

timeZone

String (body)

Change the timezone of the query, only for mode types different from JSON. This parameter supports any positive or negative GMT timezones, like GMT-2 or GMT+1

skip/offset

Number (body)

You can use either the skip or offset parameters to skip the first X elements of the query.

limit

Number (body)

Limit the results of the query. The query will stop after returning the first X elements of the query or reaching its end.

ipAsString

Boolean (body)

Set this parameter to true (ipAsString = true)if you want to get IP addresses as dotted strings (for example, 94.2.23.1). If you don't add this parameter in your request or set it to false, IP addresses will be returned as numbers (for example, 1577195265).

progressInfo

Boolean (body)

Set this parameter to true if you want to get progress info about the requested query. You will get an entry p with the timestamp of the event that is being processed at that moment. Progress info will be sent at most once every 5s. 

This is only available if you set mode.type as json/simple/compact. See an example below.

timestamp - epoch value in milliseconds

str - string

int8 - 8-byte integer

int4 - 4-byte integer

bool - boolean

float8 - 8-byte floating point

• timestamp - epoch value in milliseconds
• str - string
• int8 - 8-byte integer
• int4 - 4-byte integer
• bool - boolean
• float8 - 8-byte floating point

• timestamp - epoch value in milliseconds
• str - string
• int8 - 8-byte integer
• int4 - 4-byte integer
• bool - boolean
• float8 - 8-byte floating point